Microsoft’s Largest-Ever Patch Tuesday Ships With Two Zero-Days Already Under Attack

Microsoft’s September 2026 Patch Tuesday landed today with fixes for 966 vulnerabilities, by BleepingComputer’s count, which the outlet calls the largest single security release Microsoft has ever shipped. Two of the fixes close vulnerabilities that attackers are already exploiting: both are local elevation-of-privilege bugs that let someone who has already gained a foothold on a Windows machine jump straight to SYSTEM-level access, rather than flaws that grant remote entry into a system on their own.

The two zero-days under active attack

CVE-2026-81963 sits in the Windows Update Stack. Microsoft’s own description, which matches the wording independently recorded in the National Vulnerability Database, calls it “improper link resolution before file access (‘link following’) in Windows Update Stack” that “allows an authorized attacker to elevate privileges locally.” Microsoft credits the discovery to researcher Romain Deperne and its own Microsoft Threat Intelligence Center (MSTIC), but hasn’t disclosed how attackers are using it in the wild.

CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC), the interprocess-communication mechanism Windows components use to talk to each other. Microsoft’s description, again matching NVD’s record: “Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.” This one carries a notable detail in its credit line: threat-intelligence firm Volexity and three Proofpoint researchers, Mark Kelly, David Galazin, and Jeremy Hedges, are named as reporters, the kind of pairing that usually means a bug surfaced through real-world incident response work rather than a lab fuzzing run.

Microsoft rates both flaws “Important” on its own four-tier severity scale (Low, Moderate, Important, Critical). NVD independently scores each 7.8 out of 10, or High, under CVSS 3.1, and both share the same local-access-required vector. The “authorized attacker” language in Microsoft’s wording means whoever exploits these bugs already needs to be running code on the target machine, most likely arriving through phishing, a browser exploit, or some other initial-access route first. These are the tools an intruder reaches for after getting in the door, not the door itself.

A record shaped by AI-assisted bug hunting

BleepingComputer’s count of 966 marks a sharp jump from the 570 flaws Microsoft fixed in July and the 400 fixed in August, and the outlet reports the increase follows Microsoft’s adoption of an AI-powered vulnerability-discovery system it now uses to identify more security flaws across its own software. The category breakdown BleepingComputer published, 438 elevation-of-privilege bugs, 258 remote-code-execution bugs, 173 information-disclosure bugs, 56 denial-of-service bugs, 19 security-feature-bypass bugs, and 16 spoofing bugs, actually totals 960 on its own; adding the 13 tampering bugs separately confirmed by Cyber Security News‘ breakdown of the same release brings it to 973, which is the total that outlet reported for the month rather than BleepingComputer’s headline figure of 966. The gap is small and most likely reflects Microsoft’s Security Update Guide being a live, continuously revised database rather than a fixed bulletin: outlets querying it at slightly different times can walk away with slightly different totals. Either way, both trackers agree this is Microsoft’s biggest single Patch Tuesday on record, with more than 100 of the fixes rated Critical.

Other fixes worth flagging

Beyond the two zero-days, Cyber Security News highlighted three Critical-rated remote-code-execution bugs in Microsoft Office: CVE-2026-81959 and CVE-2026-81953 in Excel, and CVE-2026-81952 in Word. All three could be triggered simply by opening a malicious document, the kind of bug that turns a routine email attachment into an initial foothold.

CISA gives federal agencies a 14-day window

The U.S. Cybersecurity and Infrastructure Security Agency added both CVE-2026-81963 and CVE-2026-85880 to its Known Exploited Vulnerabilities catalog today, the same day Microsoft shipped the fixes, giving federal civilian agencies until September 22 to patch. That 14-day window comes from CISA’s Binding Operational Directive 26-04, which replaced the agency’s older flat remediation-deadline model in June 2026 with a risk-tiered system that can compress the window to as little as three days for the vulnerabilities CISA judges most dangerous, based on factors like public exposure and how easily an exploit can be automated. That these two zero-days landed in the 14-day tier rather than the three-day tier is itself informative: both require an attacker to already be running code on the target machine, which under CISA’s risk model makes them less urgent than a flaw reachable directly from the internet, even though both are confirmed to be under active exploitation right now.

BOD 26-04 only legally binds federal agencies, but a KEV catalog addition is a reliable signal for everyone else too: CISA is confirming real-world exploitation, not flagging a theoretical risk. Organizations running centralized patch management, whether WSUS, Intune, or a third-party tool, should prioritize this month’s cumulative update, along with the Critical-rated Office fixes, and push it out as soon as testing allows.